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Abstract of JP2001313640 

PROBLEM TO BE SOLVED: To provide an illegal access detection system capable of detecting 
illegal accesses of various patterns including an unknown method. SOLUTION: The latest access 
policy of a site to be a management object is acquired from a management server 20 and held. 
Packets addressed to the site are acquired among packets circulated in a network, and packets 
suitable for the access policy and packets unsuitable for the access policy are sorted amount the 
acquired packets. When a packet unsuitable for the policy is selected, the packet is specified as a 
packet having possibility of being an illegal access and notified to the management server 20 in order 
to change an access condition for removing an access based on the specified packet. 
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n' 2 0 C9« LT i3 < «fi«3&«* S o El 6 coMf 
(4, WWWHf— t"X (7°ob3;^iHTTPC04i^-) T14. 
r^M-f-S^r-^/Pj fcffiffl-TSURLco rjfctSt^j 
Sr^S-f-S <r t ^*T'# , /k-bf-fV^N'J COTCO r / 
Index, html j 7T-^'k r /whatsnew/ * j , r /pro 
ducts/* r /p r0 fiie/* j ( * i4ffiRcD3£f : ?!l£ 
Srf. ) CO-f -iUPhV ffiTCOf ^TC07 r 4 7K\<DT 
^•fex^f i F>ir-rSii:S:^L'rv->So -f-cofifi, rrnb 
3/MfW<Z)*frJ Ttt, ttW' rjtg^S^-^TH^ 
Xj ^fiffl* rffpj^-i.rjvyKj ^f*iSSgS*Sii: 
tT"#So 

[0034] 04^0, 

n— HUfc=TOET^-fc^ttfiI^XT-Al 0{4, *v>7 

^t^rStf^ h^C0^^-y h^ft-D^^-{4*tLSrffl 
»-TS (Xf'y/Sl 02) o iWl SSil-rS^ 0 ^-y 
h^vrtffUV^^Bl-rS.Itti^Tfl-So %CD 

^au f Ty , -tex^ , y>— ■f-x^tfja Uf^si 

03) o 

[ 0 0 3 5 ] H7{4. 7°nhn;H±«f-x ■y9cr>m±.cD 
-Wt^UfcHTfti. 7Dl3/«fx7?ll 7° 
nia;H±«f-^-xDBl lt«»§tLTV^SlP 
^-•y^", 15 7X*-M^7^\ 77'J7-y3 >S 
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H 7 tett, HTTP7*ob3;WM*0*^)W3S^S*L 
HTTPrnhrJ/H±#<7)ti:r-(i. IP^-y/, TC 
P^-y^. HTTP^-y^". HTTPx— :?<7)JIII£^x -y^§fL 

f-xy^rtSttt, ^>y hlz&if&iP'wycD&y 
-f —/I' HWffl^iE L v ^ISHfcJKS o T n h t' o tiK IP 
^■y^'COIPy/r-y -f— ^h'CDfiti: [P-^-y^* 

7 A — /Ir'HCOffit^Jf^V^if 0 A> ( IP-K^-y h:£fls 

TCPAo^fclPA^fcHatoWStSr*. *<7D&, HTT 
P^. -y r £7)# y 4 —)V Y <n 7 * - V -y h 0 tClE 

asfvc^***, httpx-^^^^-vv hmtmm*) 

IZimZtVX^^&frb' -5^<7)f-x y?&m< . HTTPTn 
h rj;WOtt«t±. M2tSMt&TS>SRFC1945^RFC2068tia 

iff. HTTP«oy^x^htf>r— ^«*CI4. J2TFf»83£tf> 
rtSWa-StfLiifcfcSroTV**. 5rtJ. "GE 
t" j&Wcfc "post" mtfih&tf, ;;tiit»ts. 

GET "Request - URL" HTTP/1.1 (A— i? g y\ACOi%> 
GET "Request - URL" HTTP/1.0 (A— >? a XL.0cO*§ 
GET "Request - URL" 

COi:^. "Request - URL" t V^v\°5.* — ^t(4. 
-/S'^^r-SURL^WASnSo £tf>BWeM:, i<SD 
J: 3 SrlM h^teOrt^iTtif-x -y ^c?)ffi 

«fc&->TV*5:V*l&& ( "HTTP/1.0" ^ "HTTP/1.1" 

[0036] — r^-tex^y^— f i^m. ^° 

/ -y h 4^ r $B5feT H VX/mt7tT F l/X/fJM7n 
( =TCP&tAJDP«9;tf- h j £0F*l§£r, T 

S. MSi^ htflfnT-^iT^-fe^iKU^-^Sfcit 
«U -tLT^ifmiflRtS^)- «y t-T"*& h¥'J 

uest-URL"0|*tf§:<7)f-x >y?(2, UTT^-feX^ 1 ;^ 
-^-x-y?2:LTfT3. $r*i, roha/Wtifiv? 
t 7/-fex,-K>J 5^— ^x -y ^fii, ^-Lt't^— 

[00 37] Ui^fx <y ?<7)*SJI. jtKLSrW^ 

x\ *tummi-& i k t*t L,TW6««!a*ff*»*v^ 

(Xfy/S 1 0 4 : No) . — iRt§A^ 7 h 



u . mmizTFiET 7 -fe x tc i & t <9>3&» k* o tom* , 

0 4 :Yes) . ;«fx-/MS(l H*L&V^>— 
^l^RHifllfc, f-x y^ISt LTIE«LT±><. <I 
«^x >y ^ mmcD— fflZtji LtlCOtm 9 X'fo h „ El 9 

( a ) ii. rnha^ftifx -y ^ (JMBtR, 131(b) 
r^-trX*f>J^-^x-y^cO^^®ST'feSo 

[0038] jtRLfc^v Si^ 

tti:{xf7/si0 5), r ^-AfflJn^T-^ r 
— XD B 1 3£#ESL-C. aa^ast/jitt^sr^s 

L(Xf77S106), jl^tWaSSr^fr-f S (Xfy 
7S 1 0 7 ) . 

[00 39] T7-AlMf-?f-^D B 1 3t 
H8^7K$ix-i.rt^W^i$tLTV^^T\ US 

o ^ a >-«ii^/x-;t/ 

22\,zi.^X. 1» 7 ? y 3 y * 7 ? y 3 y^ttf - 
[0040] zeni. o fc, ^afcJKIIlw^ffifcifUr, 

mm* -y h v- ^ mm 1 1 « ; t 

r ? -fe x oaKSttcowm* u ^ ^. -cstja l t ^ s 

f? a -iwi&fcgmxz x h mmmmmiz^ & m& *> & 

s„ 

[004 1 ] 5rt5, *5ttBKBT«, lfl»«fc:(4«fi.T 

xconi^r ^ -fex^r «j is— izi^mtitix \ ^ r 9 -fex 

hkolzLXh&W 
[0042] 
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a . . 1 3 

[0B<7>f£*&iiBJ§] 14 

[01 ] &¥ffii&mMZtL&*v !V-?yXfA^ 1 5 

ticfffiJcEh 1 6 

[02 ] x<r Avrntmiim. 2 0 

[H33 «n -9--; tcommmtfm. 2 1 

[04 ] ^sET^^xm^^'r^mmwm. 2 2 

[05 ] jgmBMI,zte\->XMKbZtL$>T7*:AcoM dbh 

&£^LJtia. DB12 

[06 ] T^-fe^sKU^— at^Tahn^HtaScoM^^ DB l 3 

LJtSL DB2 1 

[07] /nhn;H±»fx7^(0l^*Lm DB2 2 

[08 ] T7-^ffitefe^'-^-X«P^ffl£^L£ DB 2 3 

0. INT1 

[09] (a)«rnf3/l-tt|fi7?«, CON1 

(b) (iT^-tr^^" 1 ;^— f x •y^^OlSao— piJSr^rL 3 0 

£0, T 1 

[W-f-OMBJ] a 

I 0 ^lET^-feX^tt^X^A y3 

II T7*LAtfVis—W&fJx.—)V T 



**y h7-^Miif-^^-X 

, INT2 ^7f7-^-fy?7i-X 
, CON 2 ±$IOTgP 
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